feat: add SLSA Level 3 build provenance + unified badge header (#6)

Fieldnote-Echo · claude · web-flow · commit 664f3ad1ba89 · 2026-03-03T18:30:34.000-06:00
Extract reusable build workflow with attest-build-provenance for SLSA L3.
Refactor publish.yml to call it. Standardize README badges across the
Project-Navi org.

Co-authored-by: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/_build-reusable.yml b/.github/workflows/_build-reusable.yml
@@ -0,0 +1,86 @@
+name: Reusable Build (SLSA L3)
+
+on:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b  # v2.15.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098  # v5.4.2
+        with:
+          enable-cache: true
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Smoke test
+        run: |
+          uv venv .smoke-venv
+          uv pip install dist/*.whl --python .smoke-venv/bin/python
+          .smoke-venv/bin/python -c "
+          from navi_sanitize import clean, walk, jinja2_escaper, path_escaper
+          assert clean('hello') == 'hello'
+          assert walk({'k': 'v'}) == {'k': 'v'}
+          print('Smoke test passed')
+          "
+
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11  # v0.23.0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: navi-sanitize.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Generate SPDX SBOM
+        uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11  # v0.23.0
+        with:
+          path: .
+          format: spdx-json
+          output-file: navi-sanitize.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        with:
+          subject-path: |
+            dist/*
+            navi-sanitize.cdx.json
+            navi-sanitize.spdx.json
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Upload SBOM artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: sbom
+          path: |
+            navi-sanitize.cdx.json
+            navi-sanitize.spdx.json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -4,8 +4,7 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -14,80 +13,59 @@ concurrency:
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
 
-  publish:
+  build:
     needs: [ci]
+    uses: ./.github/workflows/_build-reusable.yml
+    with:
+      tag_name: ${{ github.event.release.tag_name }}
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+
+  publish:
+    needs: [build]
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     environment: pypi
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
-        with:
-          enable-cache: true
-      - name: Build wheel and sdist
-        run: uv build
-      - name: Smoke test
-        run: |
-          uv venv .smoke-venv
-          uv pip install dist/*.whl --python .smoke-venv/bin/python
-          .smoke-venv/bin/python -c "
-          from navi_sanitize import clean, walk, jinja2_escaper, path_escaper
-          assert clean('hello') == 'hello'
-          assert walk({'k': 'v'}) == {'k': 'v'}
-          print('Smoke test passed')
-          "
-      - name: Upload dist
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - name: Download dist artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: dist
           path: dist/
+
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
         with:
           print-hash: true
 
   release-assets:
     needs: [publish]
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
-      id-token: write
-      attestations: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      - name: Download dist artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: dist
           path: dist/
-      - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 # v0.23.0
-        with:
-          path: dist/
-          artifact-name: navi-sanitize.cdx.json
-          output-file: navi-sanitize.cdx.json
-          format: cyclonedx-json
-          upload-artifact: false
-          upload-release-assets: true
-      - name: Generate SPDX SBOM
-        uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 # v0.23.0
-        with:
-          path: dist/
-          artifact-name: navi-sanitize.spdx.json
-          output-file: navi-sanitize.spdx.json
-          format: spdx-json
-          upload-artifact: false
-          upload-release-assets: true
-      - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+
+      - name: Download SBOM artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
-          subject-path: |
-            dist/*
-            navi-sanitize.cdx.json
-            navi-sanitize.spdx.json
-      - name: Upload dist to release
+          name: sbom
+          path: sbom/
+
+      - name: Upload to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
           TAG_NAME: ${{ github.ref_name }}
-        run: gh release upload "$TAG_NAME" dist/* --clobber
+        run: gh release upload "$TAG_NAME" dist/* sbom/* --clobber
diff --git a/README.md b/README.md
@@ -1,11 +1,13 @@
 # navi-sanitize
 
-[![CI](https://github.com/Project-Navi/navi-sanitize/actions/workflows/ci.yml/badge.svg)](https://github.com/Project-Navi/navi-sanitize/actions/workflows/ci.yml)
-[![Fuzz](https://github.com/Project-Navi/navi-sanitize/actions/workflows/fuzz.yml/badge.svg)](https://github.com/Project-Navi/navi-sanitize/actions/workflows/fuzz.yml)
-[![codecov](https://codecov.io/github/Project-Navi/navi-sanitize/graph/badge.svg?token=9Vr26NV2Fn)](https://codecov.io/github/Project-Navi/navi-sanitize)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![Python 3.12+](https://img.shields.io/badge/Python-3.12%2B-green.svg)](https://www.python.org/)
+[![Tests](https://github.com/Project-Navi/navi-sanitize/actions/workflows/ci.yml/badge.svg)](https://github.com/Project-Navi/navi-sanitize/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Project-Navi/navi-sanitize/actions/workflows/codeql.yml/badge.svg)](https://github.com/Project-Navi/navi-sanitize/actions/workflows/codeql.yml)
+[![codecov](https://codecov.io/gh/Project-Navi/navi-sanitize/graph/badge.svg?token=9Vr26NV2Fn)](https://codecov.io/gh/Project-Navi/navi-sanitize)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Project-Navi/navi-sanitize/badge)](https://scorecard.dev/viewer/?uri=github.com/Project-Navi/navi-sanitize)
+[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev)
+[![PyPI](https://img.shields.io/pypi/v/navi-sanitize)](https://pypi.org/project/navi-sanitize/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Python 3.12+](https://img.shields.io/badge/python-3.12%2B-blue.svg)](https://www.python.org/downloads/)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 
 Deterministic input sanitization for untrusted text. Zero dependencies, zero false positives.
